CVE-2024-4319mediumCWE-862

CVE-2024-4319: falha de média gravidade em vsourz1td Advanced Contact form 7 DB

Advanced Contact form 7 DB <= 2.0.2 - Missing Authorization to Unauthenticated Information Disclosure

Publicada em · Atualizada em

Seguir esta CVE+ Monitorar Advanced Contact form 7 DB

Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.

13Vexday Risk Score

Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.

ssvc Trackcvss 5.3epss 0.5%
The Advanced Contact form 7 DB plugin for WordPress is vulnerable to unauthorized access of data due to a missing capability check on the 'vsz_cf7_export_to_excel' function in versions up to, and including, 2.0.2. This makes it possible for unauthenticated attackers to download the entry data for submitted forms.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Produtos afetados
vsourz1td · Advanced Contact form 7 DB
CVEs relacionadas — vsourz1td Advanced Contact form 7 DB

No mesmo produto, das mais perigosas para as menos.

CVE-2024-3723MEDIUMAdvanced Contact form 7 DB <= 2.0.2 - Sensitive Information ExposureEPSS 0.4%CVE-2026-18594MEDIUMAdvanced Contact form 7 DB <= 2.1.3 - Missing Authorization to Authenticated (Custom+) Unauthorized Data Import via 'import_cf7_id'EPSS 0.4%CVE-2026-6831MEDIUMAdvanced Contact form 7 DB <= 2.1.1 - Missing Authorization to Authenticated (Contributor+) Information Disclosure via 'acf7db' ShortcodeEPSS 0.4%CVE-2026-0814MEDIUMAdvanced CF7 DB <= 2.0.9 - Missing Authorization to Authenticated (Subscriber+) Form Submissions Excel ExportEPSS 0.3%CVE-2026-0811MEDIUMAdvanced CF7 DB <= 2.0.9 - Cross-Site Request Forgery to Form Entry DeletionEPSS 0.1%